26.9：版本号统一 + CI 精简 + 前端产物重建

- 全项目版本号统一：v3.x 迭代号（26.9/26.9/26.9/26.9 及裸 v2/v3）→ 26.9，
  覆盖 Go 注释 / 文档 / openapi.yaml / README×4 / 前端源码（80+ 处）
- v31_test.go 更名 custom_code_test.go；TestV2AccessorDefaults → TestKVAccessorDefaults
- docs/api/00-overview.md 更新日志合并为单条 26.9 条目（修复错位拼接）
- .goreleaser.yaml 头部注释与实际一致（Pro 2.18.1 / GITEA_TOKEN / semver tag 要求）
- CI：release-image.yml → ci.yml，仅保留 vet+test 门禁；
  镜像发布移交 GoReleaser Pro（原 build-push 的 tag 校验与 26.9 版本方案冲突，历史 9 次失败）
- 前端重建：server/web/dist 与 web-embed 同步（docs 文案嵌入更新）

.gitea/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI 测试
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+  workflow_dispatch:
+
+# 镜像发布不再走 CI：GoReleaser Pro（本地 goreleaser release --clean）
+# 负责多平台归档 + Gitea Release + ACR 双架构镜像（见 .goreleaser.yaml）。
+# 本工作流只做推送/PR 前置测试门禁。
+
+jobs:
+  test:
+    name: go vet + go test
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.27.1-alpine
+    timeout-minutes: 30
+    steps:
+      - name: 安装工具并检出
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
+          apk add --no-cache git curl bash >/dev/null
+          SCHEME="${GITHUB_SERVER_URL%%://*}"
+          SRV="${GITHUB_SERVER_URL#*://}"
+          echo "clone from ${SCHEME}://${SRV}"
+          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
+            "${SCHEME}://oauth2:${GITHUB_TOKEN}@${SRV}/${GITHUB_REPOSITORY}.git" .
+
+      - name: go vet + go test
+        working-directory: server
+        env:
+          GOCACHE: /tmp/.gocache
+          GOMODCACHE: /tmp/.gomodcache
+          CGO_ENABLED: "0"
+        run: |
+          go vet ./...
+          go test ./... -count=1

.gitea/workflows/release-image.yml

@@ -1,135 +0,0 @@
-name: Release 镜像
-
-on:
-  push:
-    branches: [main]
-    tags: ["v*", "26.*", "27.*"]
-  workflow_dispatch:
-
-env:
-  REGISTRY: registry.cn-hangzhou.aliyuncs.com
-  IMAGE: registry.cn-hangzhou.aliyuncs.com/skymirror/fileshare
-
-jobs:
-  test:
-    name: 测试（推送前置门禁）
-    runs-on: ubuntu-latest
-    container:
-      image: golang:1.27.1-alpine
-    timeout-minutes: 30
-    steps:
-      - name: 安装工具并检出
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
-          apk add --no-cache git curl bash >/dev/null
-          SCHEME="${GITHUB_SERVER_URL%%://*}"
-          SRV="${GITHUB_SERVER_URL#*://}"
-          echo "clone from ${SCHEME}://${SRV}"
-          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
-            "${SCHEME}://oauth2:${GITHUB_TOKEN}@${SRV}/${GITHUB_REPOSITORY}.git" .
-
-      - name: go vet + go test
-        working-directory: server
-        env:
-          GOCACHE: /tmp/.gocache
-          GOMODCACHE: /tmp/.gomodcache
-          CGO_ENABLED: "0"
-        run: |
-          go vet ./...
-          go test ./... -count=1
-
-  build-push:
-    name: 多架构构建并推送 ACR
-    needs: test
-    runs-on: ubuntu-latest
-    # dind 自带独立 daemon：不依赖 runner 宿主机 docker.sock 转发配置
-    container:
-      image: docker:27-dind
-      options: --privileged
-    env:
-      DOCKER_HOST: unix:///var/run/docker.sock
-      DOCKER_TLS_CERTDIR: ""
-    timeout-minutes: 120
-    steps:
-      - name: 启动 dind daemon 并检出
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
-          apk add --no-cache git bash >/dev/null
-          # dind daemon 配置国内 registry mirror（docker.io 直连不可达）
-          mkdir -p /etc/docker
-          printf '{"registry-mirrors":["https://docker.m.daocloud.io","https://docker.1ms.run"]}' \
-            > /etc/docker/daemon.json
-          dockerd --host=unix:///var/run/docker.sock >/tmp/dockerd.log 2>&1 &
-          for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 1; done
-          docker info --format 'dind 就绪: {{.ServerVersion}}'
-          SCHEME="${GITHUB_SERVER_URL%%://*}"
-          SRV="${GITHUB_SERVER_URL#*://}"
-          git clone --depth=1 --branch "$GITHUB_REF_NAME" \
-            "${SCHEME}://oauth2:${GITHUB_TOKEN}@${SRV}/${GITHUB_REPOSITORY}.git" .
-
-      - name: 安装 QEMU binfmt（跨架构）
-        run: |
-          docker run --rm --privileged tonistiigi/binfmt:latest --install all 2>/dev/null \
-            || docker run --rm --privileged docker.m.daocloud.io/tonistiigi/binfmt:latest --install all
-
-      - name: 计算 tag（以 APP_VERSION 为唯一版本源）
-        id: meta
-        env:
-          REF: ${{ gitea.ref }}
-        run: |
-          VER=$(sed -n 's/.*APP_VERSION = "\(.*\)".*/\1/p' server/cmd/server/main.go | head -1)
-          [ -n "$VER" ] || { echo "无法从 main.go 解析 APP_VERSION" >&2; exit 1; }
-          echo "APP_VERSION=$VER"
-          if [[ "$REF" == refs/tags/* ]]; then
-            # tag 触发：要求 tag 名与 APP_VERSION 一致，防错版发布
-            TAG_VER="${REF#refs/tags/}"
-            TAG_VER="${TAG_VER#v}"
-            [ "$TAG_VER" = "$VER" ] || { echo "tag($TAG_VER) != APP_VERSION($VER)，拒绝发布" >&2; exit 1; }
-          fi
-          echo "version=$VER" >> "$GITHUB_OUTPUT"
-          echo "tags=${IMAGE}:${VER} ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
-
-      - name: 登录阿里云 ACR
-        env:
-          ACR_USER: ${{ secrets.ACR_USERNAME }}
-          ACR_PASS: ${{ secrets.ACR_PASSWORD }}
-        run: |
-          echo "ACR 用户: $ACR_USER (密码 ${#ACR_PASS} 位)"
-          printf '%s' "$ACR_PASS" | docker login "$REGISTRY" -u "$ACR_USER" --password-stdin
-
-      - name: buildx 多架构构建并推送
-        env:
-          TAGS: ${{ steps.meta.outputs.tags }}
-        run: |
-          # docker-container 驱动才支持多平台。基础镜像/APK/NPM 全部走国内源：
-          # runner 侧网络对 docker.io 存在 DNS 污染（证书误配 facebook 域），不可直连
-          docker buildx create --name multiarch --driver docker-container >/dev/null 2>&1 || true
-          docker buildx use multiarch
-          ARGS=""
-          for t in $TAGS; do ARGS="$ARGS -t $t"; done
-          # provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation）
-          # buildx 会把 docker login 的 ACR 凭据转发给 buildkitd（私有基础镜像可拉）
-          docker buildx build \
-            --builder multiarch \
-            --platform linux/amd64,linux/arm64 \
-            --provenance=false --sbom=false \
-            --build-arg NODE_IMAGE=registry.cn-hangzhou.aliyuncs.com/skymirror/node:20-alpine \
-            --build-arg GO_IMAGE=registry.cn-hangzhou.aliyuncs.com/skymirror/golang:1.27.1-alpine \
-            --build-arg RUNTIME_IMAGE=registry.cn-hangzhou.aliyuncs.com/skymirror/alpine:3.20 \
-            --build-arg NPM_REGISTRY=https://registry.npmmirror.com \
-            --build-arg APK_MIRROR=https://mirrors.aliyun.com \
-            --push \
-            -f deploy/Dockerfile \
-            $ARGS \
-            .
-
-      - name: 校验远程 manifest（双架构）
-        env:
-          VERSION: ${{ steps.meta.outputs.version }}
-        run: |
-          docker buildx imagetools inspect "${IMAGE}:${VERSION}" | grep -E "linux/amd64|linux/arm64"
-          echo "推送完成: ${IMAGE}:${VERSION} + ${IMAGE}:latest"